AI in school: the questions to ask before anyone pastes pupil data

A member of staff has found a tool that turns a long document into a useful summary. It saves time. Then someone asks whether it could summarise an annual review. That is the point to pause and check what has changed.

A public policy and a child's education, health and care plan do not carry the same risks. A sensible school AI policy helps colleagues recognise that difference before they upload anything.

Start with the task, not the badge

The DfE advises schools to understand how an AI tool uses personal data and involve their data protection officer. A supplier saying it is secure does not explain the particular service, account type and settings your staff will use.

Write down the job in one sentence. Could a general letter about collection arrangements be drafted without names or individual circumstances? Give staff a useful approved example, rather than leaving them with a policy that only says be careful.

Ask specific questions

• What information is sent, including uploads and conversation history?
• Which organisations process it, and in which countries?
• How long is it retained, including logs and backups?
• Is it used for model training, and do the terms match our account?
• How can the school delete information, control access and report an incident?

Ask your DPO to help establish the lawful basis, contracts and whether a data protection impact assessment is required. Keep the answers with the approval decision.

A parent chatbot needs boundaries too

Public information can become a private conversation. A parent asking about uniform is one thing; someone describing a safeguarding concern is another. Decide what the chatbot should answer, when it directs someone to staff and how urgent concerns are handled. Test those situations before launch.

Check answers against published information. Test a wrong premise, an old date and a question the website cannot answer. A confident invention is worse than a clear admission that someone needs to help.

Make the safe route the easy route

Our suggestion is a one-page staff guide: approved tools, allowed tasks, prohibited information, who reviews outputs and who to ask. Review it when the product or its terms change. Keep professional decisions with the people accountable for them.

Ask those questions of Schoolgle as well. Our data protection hub starts a product-specific review. This is practical guidance for schools in England, not approval to share a particular dataset.